Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A global financial firm, "ApexCapital," is designing a secure reporting application. Users authenticate via an external SAML 2.0 Identity Provider (IdP) mapped to an IAM role in an Identity Account. Once authenticated, users must read financial reports from an Amazon S3 bucket located in a separate Core Data Account. The S3 bucket is encrypted. The solution must enforce strict compliance controls and restrict access to authorized users. Which two configurations are required to grant the federated users access to the encrypted reports in the Core Data Account? (Select two.)

  1. Configure the S3 bucket policy in the Core Data Account to explicitly grant s3:GetObject permissions to the ARN of the federated IAM role from the Identity Account.Answer
  2. Encrypt the S3 bucket using a Customer Managed Key (CMK) in the Core Data Account, and configure its key policy to grant the federated IAM role from the Identity Account kms:Decrypt permissions.Answer
  3. C
    Encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) in the Core Data Account, and configure the default key policy to grant the federated IAM role kms:Decrypt permissions.
  4. D
    Attach a Service Control Policy (SCP) to the Core Data Account's Organizational Unit (OU) that explicitly allows s3:GetObject and kms:Decrypt for the federated IAM role principal to bypass local policy requirements.
  5. E
    Configure the trust policy of the federated IAM role in the Identity Account to allow the sts:AssumeRole action for the SAML identity provider principal.

Answer

To allow cross-account access to encrypted S3 objects, you must grant read permissions in the S3 bucket policy and decrypt permissions in the KMS key policy using a Customer Managed Key (CMK).
To enable federated users from the Identity Account to access encrypted S3 objects in the Core Data Account, two main configurations are required. First, the S3 bucket policy in the Core Data Account must explicitly trust the cross-account role ARN and grant s3:GetObject permission. Second, because cross-account S3 access to KMS-encrypted objects requires permissions on the KMS key, a Customer Managed Key (CMK) must be used. The CMK key policy in the Core Data Account must explicitly grant kms:Decrypt permissions to the IAM role in the Identity Account.

Step-by-Step Solution

1
Evaluate S3 bucket encryption requirements for cross-account access.
Determine that a Customer Managed Key (CMK) must be used instead of the default AWS-managed key.
AWS-managed KMS keys do not allow their policies to be modified, making cross-account delegation impossible.
2
Configure the S3 bucket policy in the Core Data Account.
A bucket policy is added that allows s3:GetObject to the federated IAM role principal from the Identity Account.
Cross-account access requires permissions to be granted explicitly at both the source (IAM policy) and target (resource policy) levels.
3
Configure the KMS key policy in the Core Data Account.
The CMK key policy is updated to grant kms:Decrypt permissions to the federated IAM role.
The S3 service uses the caller's identity (the cross-account federated role) to decrypt the data, requiring key policy permissions.

Key Concept

Cross-account S3 access with KMS encryption requires explicit delegation on both the S3 bucket policy and a Customer Managed Key (CMK) policy.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic